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20 . (Prcnou sfer Pwsented) A meOiod for poUcy^based billing for a distributed network 



session, coinprising: 



receiving « plwaUty of pautota at a phnaUty of analyzers; 



(b) aggiegatiDg the plwelity of pockets; 

(c) BHdyaag the pluraU^ofpactats to identify a plw^^^ 

(d) {^"t l ^ fS * gesflioa aagodated with the flows; 

(e) identifying at least one application Bssodatod with the , 

(0 reconstiuding the session utilizaag the identified «>plic«ico, the aesaion 
leoonstruction Iwiflg carried out « a ptarality of coUaboiatinfi nodes; 

(g) identifying a user assodaied vrtfh the sesaon; 

(h) dctenniningapolioyjand 

(i) bjffii^ the user fbrthe season in Bccoidanoc wife policy; 
whsein the session loconslruction is perfcnned at a fiist analyzer, and 

upon a successful session recooStructien oathe &st aflflly2er,afinrt 
aiessage is sent to at least one second analyzer separate from the first analyzer, the 
flistmessage comwpondingto sesaondata, and 

upon an unsuccessful session reconstruotion on Ihe first analyzer, one or 
mote messages is sent to the second anatyzer. the one or more messages inoluding 
unrecognized data. 

21. (Original) m method as ledted in claim 20. and fimhacamprisingfiUeri^ 
packets fijr removing packets onrdated to the session. 

22. (Original) The mofliod as recited in clahn 20. and further ccanpiising Ideiriifying 
application cvcnb assooiated with the session based onihcpoBcy. 



23 . (Orifiinal) The tneQiod ts lecited in ckim 22, and fiirtlia: comprising asaiff^nB a 
signlfic&nee to the ^plication events Ijosed on th& podlcy. 

24. (Original) The method as recited bs ckim 22, -wtoreln to uaer is billed Csr the 
se^m utilizing the applicetion ervotts in accotd«nce wlfb tlie policy. 

25 . (Orlguml) The method as le&lted m clma 23> and further comprisdug detemiidxig 
billing infbrmatlon fyt the session Twmg the Bjjplicftticn flfveaats in aoDordanoc •s^'ith the 
policy. 

26. (Original) Th« method m reoited in olfthn 2S» end flirUiec compriaing Girtputting a 
Nipoxt iududing bjUlng infbixnation in acconlaaoe with the i)olicy. 

27. (Original) The method as xecited in claim 20, and ftirther oos^tising reatricting 
*aqTfji of the user In acootdanaa with tfsa policy. 

28. (OrigiaaE) The method aa lecftedin claim 27, \dietehi an amount of bandwidth ia 
' cofitricted In accorfanoe with the policy. 

29. (OrigSnal) The method as w&ited in abdm 20, whflwift the policy includes a acrita 
of packet capture language fficpr«ss!«i9 and ouqmt MleofiorB. 

30. (Currently Amended) A computer program pmAirt ftmhodiaA on a Doratrntar 
readahle med ium. wMc^ -ftrfien eacttcuted bv a Qomtnitftr oaiifies the cammiter tQ WfOmLA 
IC^Shfid for pollcy^ba«ed hillios &r a diytributBd natwoxk wesiDn, compriaing: 

(a) compmer code for rtoaiving a pltirtdity of padcata at a plurality of anaiyzBre; 

(b) computer oode for aggi-egating the pluzaliiy of packets; 

(c) computer cede Cjt analyzing the plurality of paclceta to identify a plurality of 
flowa; 

(d) oompittct code for ideating a sessiooi associated 'ortth the flowa; 

(a) ocmputer code for identi^g at leaat cue application associated with the session^ 



(f) eompu^w code fix rcoan«tiucting thjs sBsrion utilizhtg th* identified ajjplioation* 
the scMion T wonjtnifttioa "bcmfi «urrted out at a plurality of aollaboraiing nodea; 

(g) computer oodc &r Ideati&uig aiuor asfioeiated with the sesfLon, 

(h) o&mputer code for dotemiinlng a policy^ ami 

(i) computcrcode fcirMUngthc usex forthe wssioaln aoooKiftiica with, the polkyi 
wKcfcixx ^ neBSlon reconstniction la pafamiDd at a fust flzialyzer> tad 

upoa a suoccesful ses&loti reoonBtruction od the fitst a0alyzer» a Qis\ 
mesBttgc 12 stnt tc at least one second andly2er separate f^om the flr^ analyzer, the 
first mesBfl^coirespottduig to sefiuon data, end 

upon an unsuccossful aessicm tecon9tructLoii cm the ^st enalyzeri one or 
moic mess&ges is seot to the secQod ane^vxer, the one or mora messages iiidudizig 
unreoogniaed data. 

3 1. (Original) The computer program prQ<h»t aa xecltod ^n daim 30, and furfhor 
ooit^ifslngoomputercodefbr j611iailagih»pBok«ts£6ireaaaovingp«cl^um 
session. 

32* (Odgln&I) The computer program produot aa rcoited in cialni 30, aad &rthcT 
compriauxg computer code &r ideati&lng plication avcmts associated ivith the seaaion 
befodoxLtbepoUoy. 

33» (Original) The computer program product as r«ctt«d in claim 32» and further 
comprising computer OQda for aAaigning a szgxufloance to the applicAtloa evaati baud on 
thepoUoy* 

34. (Original) The oomputor program product ae reoited in olaiw 32, wherein the uot 
is billed for the session utilitiag tlia applicat!on events in. acoordanoe >vith tlie policy. 

35. (Original) The computsr progrEmi produot as secited in claim 32, and fiir^ 
compriaing computer code for dctennlnmg billing infbnxistlon &f the seeston using the 
appIicatioiL evaaits Ln accordance the poUoy. 



36. (Orlg[nai) TTie computer prop^ produot u redtcd In claim 35, «nd fiuthor 
oompiifling computer code fbx oittputtmg a report inclodl^g th& bUIiag ixi^a^afioa iu 
eccordaJiDB vdth the polity. 

37. (Original) TbB computer progrflin product bs redted ia <Mm 30f £nd fltfChdf 
oflmprffllng oompuler code for rtetrictJne tasks of ihB uaer in accordaaca with the policy. 

38. (OrisiziAl) The ccinpater program product recited in clium 37, wbeivm na 
fittiount of bandwidth is leBtxictod in Bccordsnoc with the policy. 

39. (Original) Tlie oomputair progrun prodoot w redtod in claim 30, Mrhecein tho 
polioy InclodM a 6crico of pacloet capture language exprtsB^ons nod output selectors. 

40. (Prevloiisly frasesntsd) A method for pdUoy-basod Mltng &r a distributed network 
SMsion. ooooprising: 

(&) reccivins a pkiAlit" of paokcts d a plurality of anaiyzera; 
(b) ftsgnfgetlflgtbepiurBll^ofpabkfita; 

(0) analy^in^ iho plurality of p&clcMs to identify Bt least b flzst £lo«^i 

(d) idflaudfying a scGdlon OBSOolGcted Tidth the flist flow; 

(e) tdenti^ing additicmfll flaws in the plurali^ of paolcets assoolated with the aessdon; 
(0 filtering the packets fbr removing paotots unrelated to the aession; 

(g) idenfiftinS ^ COie appliUsAtion asaocdatad vn&x lha session; 

(h) rcconatructins the session utilizing the idccUiEed 0o?plication« the ae^aion 
rcDonatruotioD being ceixied out u a plurality of eoUfiboTBtlnfl nodes; 

Q) fdentiQrlng a user aaaocJalad with the ao&afon; 
(j> identif^ng a policg^; 

(k) gathering appUcation eventi Bflsnciated vnik the seaaion baaed On (he polioy; 

(1) a^gojlAg a aignificanod to the fipplicotion events based on the policy; 

(m) ddermining billing Inibrmation fbr the ^easlon using the application events In 
accordance with the policy; 



(n) outputtiBg a report induding thfl billing tafoanatlon In accotdanw with the policy; 

(o) icrtrictiag tasks of the usesr in wccffdance wMh Ihe potioy; and 

(p) oxecutiag actiotiff m raponaB to tii& appUoadoa ftveuts itt actordmce with lh€ 

polioyj 

wborein the aosdlan reconatrucdoa is pwforouBd Bt a first wwlyzar, and 

upon a auoocsaful session reconatiadion on the Srst findyzGr, afiiBt 

message Is Bftnt to st least one second eEtnalyzei' separate fiom the fizet ^oaIyxer> chft 

first m«69af & coirc^ondlng to 9ea ^ion dafta, and 

upon All unBUCcesBftil sesuon reconstruction on the flcs( enalyzcTj one or 

moEc mcssageft is irent to the Bc&ojid analy^, the one or znore messages including; 

unt«DO£ni£ed data. 

4U (PrevJoualy pjesented} The method as ceoitad in olslm 20, whereb a fixat flow 
mo<imA urtth a first appllcatton flows throu^ a first one of thio nod&s. 

42» (Previously Pffl*eni«d) The mefliod as recited tn claim 41, vtoein a aecond flow 
BSBocaftted vdth the flivt applioaticm flows tfaroufitli a seoond ocia of the nodes. 

43, (Previously Prcsmted) TbJ» method sa recited in cl^m 20i Whm^ti each of the 
ooUaboradns nodes (ncjadfle a pocket aouree and afixtrt hierarchical oetwoik 93aalyw^« 

44, (?reviouflly Pjtsentcd) The method afi recited In claim 43 , wherein ewh of the 
oollabofEcdng nodes Atrther inchides a^tcr &cmpled betweoi the pa&keit souroc Etndtho 
firat tieFaicbioal network analyzer. 

45, (Previously Prwenlod) The method as redtedin claim 43, Mteeia the fiirit 
hierarchical actwocrk onalyzets of each of the nodes fted infbnnatSon to a seeond 
hiemchlcal nstworie analyzer. 



46» CP«vicu3ly Pt»fl«iied) The maflwxl a$ recfted in clnim 45, wterein the 
inforaiBtion is \wed by the tecoMl hicrwchiod netwodk analyzer to leccrastiuot the mbbLou 
ulilizisg the identified i^prlicfidon. 

47. (Pwvigusly PrcBcatcd) Hib me£hod ^ recited in dedm 45, wheceixi the 
infozmatxon involves pfioket f^rwardiog. 

46. (Pxcvioualy Pmentsd) The method as reoillfid In olaim 45, TiuereiB th& 
ItifoniiatLon mvolvea hintd mid paoket ftrwaiding, th& Uuts beuig gfic«rated a low^i 
L9vel session ensfyaa and provided to t higiher level analyzer to ftellitat« 
iwoitttracGoo of tho session. 

4^. (Pxeviously Pieocnted) The method «s rodtad in dsim 45, wbema the 
bfbimaticA involved hints and a summBzy of ifadcetSi tfie hims being fienerotod by a 
lower level session onalyzer and pxovided to a highsr level analyzer to facilitate the 
reoonatnution of the seesiciL 

50. (Pi«viously Praented) The method as reeited in olalxn 20, vvbereih tbz aodes each 
include a routei'. 



